Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2026-46164

btrfs: fix double free in create_space_info_sub_group() error path

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info_sub_group() error path When kobject_init_and_add() fails, the call chain is: create_space_info_sub_group() -> btrfs_sysfs_add_space_info_type() -> kobject_init_and_add() -> failure -> kobject_put(&sub_group->kobj) -> space_info_release() -> kfree(sub_group) Then control returns to create_space_info_sub_group(), where: btrfs_sysfs_add_space_info_type() returns error -> kfree(sub_group) Thus, sub_group is freed twice. Keep parent->sub_group[index] = NULL for the failure path, but after btrfs_sysfs_add_space_info_type() has called kobject_put(), let the kobject release callback handle the cleanup.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 64c7ddda83acfbaa0efb381a1928ce908c584607 to < c2d59527cba6d59f0d77a75c1101ab4e69758beaaffected
  • 0bd151ce4200ca847990e05cca29a76456982ca5 to < d2a675f2e238ec96c8e91e2718c1f910c9c8fb21affected
  • 190d5a7c4fe42b8c9aa46e3336389e7cb10395bb to < 14b22be1dd844383eb03af9b1ee3b6b25d32aeafaffected
  • f92ee31e031c7819126d2febdda0c3e91f5d2eb9 to < dfd05a16b5c9d1d98b47905f37f2fccda52173d1affected
  • f92ee31e031c7819126d2febdda0c3e91f5d2eb9 to < 259af6857a1b4f1e9ef8b780353f9d11c26a22bdaffected
  • f92ee31e031c7819126d2febdda0c3e91f5d2eb9 to < a7449edf96143f192606ec8647e3167e1ecbd728affected
  • 6.1.162 to < 6.1.176affected
  • 6.6.122 to < 6.6.141affected
  • 6.12.67 to < 6.12.90affected

Linux Linux

Default version status: affected

  • 6.16affected
  • 0 to < 6.16unaffected
  • 6.1.176 to ≤ 6.1.*unaffected
  • 6.6.141 to ≤ 6.6.*unaffected
  • 6.12.90 to ≤ 6.12.*unaffected
  • 6.18.32 to ≤ 6.18.*unaffected
  • 7.0.7 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References